Integrate renovate bot for all dependency updates by silverwind · Pull Request #37050 · go-gitea/gitea

silverwind · 2026-03-31T10:07:20Z

Replaces Dependabot with Renovate. The new setup:

One PR per ecosystem (GitHub Actions, Go modules + Makefile go-tool pins, npm, Python via uv, Nix flake), opened weekly on Mondays with a 5-day release-age cooldown. Vulnerability PRs ship next-day via daily cron + Renovate's vulnerabilityAlerts schedule bypass.
All uses: action refs SHA-pinned with patch-level version comments (same format as Pin all GitHub Actions to commit SHAs #36971, which this supersedes); helpers:pinGitHubActionDigests keeps future bumps in that format.
renovatebot/github-action runtime image pinned via the upstream-recommended RENOVATE_VERSION env + magic comment + customManagers:githubActionsVersions preset, so Renovate keeps the pin updated.
Custom regex manager tracks the *_PACKAGE ?= <import-path>@<version> lines in Makefile (golangci-lint, swagger, actionlint, etc.) and groups them into the same Go PR via matchDatasources: ["go"].
Post-upgrade tasks regenerate assets/go-licenses.json (make tidy) and the SVG sprite (make svg), gated by an env-level command allowlist.
Replaces the standalone cron-flake-updater workflow — Renovate's nix manager tracks flake.nix inputs and produces the same flake.lock bump PRs on the regular weekly schedule.
npm and gomod-replace pins live in renovate.json5 only; updates@17.16.3 reads them from there too, so the standalone updates.config.ts is gone and one source of truth covers both tools.

Fixes: #33386

Admin steps before/after merge

Two prerequisites in the go-gitea/gitea repo:

1. Create the `RENOVATE_TOKEN` secret

Use the existing @GiteaBot account so commits and PRs are authored under the project's established bot identity.
Sign in as GiteaBot and mint a fine-grained PAT scoped to go-gitea/gitea only:
- Repository permissions: Contents: Read and write, Pull requests: Read and write, Workflows: Read and write, Metadata: Read-only (auto-added). The Workflows permission is required so Renovate can update .github/workflows/*.yml via the github-actions manager — without it, action-bump PRs fail.
- Expiration: as long as policy allows; calendar a renewal.
- A classic PAT works too, but needs both repo AND workflow scopes; fine-grained is preferred.
Confirm GiteaBot has write access on go-gitea/gitea (needed to push the renovate/* branches); add it as a collaborator if not already.
Repo → Settings → Secrets and variables → Actions → New repository secret → name RENOVATE_TOKEN, value = the PAT.

2. (Recommended) Branch protection for `renovate/**`

Repo → Settings → Rules → New ruleset → name "Restrict Renovate".
Target branches: include renovate/**.
Bypass list: add GiteaBot.
Rules: enable "Restrict creations" only — prevents anyone other than GiteaBot from creating spoofed renovate/* branches. Do not enable "Restrict pushes": maintainers still need to be able to push fixups to existing Renovate PRs (conflict resolution, small tweaks before merge).

3. Verify

Actions tab → cron-renovate → "Run workflow" to trigger manually instead of waiting for the next daily run.
First run will open a "Configure Renovate" onboarding PR (one-time) and then the dependency dashboard issue. After the onboarding PR is closed/merged, regular update PRs start appearing.

No GitHub App registration, no private key handling — a single PAT secret is the only credential.

This PR was written with the help of Claude Opus 4.7

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

TheFox0x7 · 2026-03-31T10:13:23Z

Alternatively we can run it in our CI directly, though it's also via app just not the mend one.
cc @techknowlogick per the discord talk few months ago

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

Signed-off-by: silverwind <me@silverwind.io>

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

silverwind · 2026-03-31T10:45:18Z

Once this is merged, I think we could go ahead with #36971, renovate understand and can update the SHA format, so no manual updates needed.

Copilot

Pull request overview

This PR migrates GitHub Actions dependency update automation from Dependabot to Renovate by adding a Renovate configuration and a scheduled workflow, and removing the existing Dependabot configuration.

Changes:

Add renovate.json to configure Renovate for github-actions updates with matching labels and a 5-day minimum release age.
Add a scheduled GitHub Actions workflow to run Renovate using a GitHub App installation token.
Remove .github/dependabot.yml to disable Dependabot updates.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`renovate.json`	Introduces Renovate configuration to manage GitHub Actions updates with repo labels and release age delay.
`.github/workflows/cron-renovate.yml`	Adds a scheduled/manual workflow to run Renovate using a GitHub App token.
`.github/dependabot.yml`	Removes Dependabot configuration now superseded by Renovate.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

TheFox0x7

Thanks for this in general :)
I wanted to do it for a while but I didn't feel like the correct person to set it up with all the secrets needed to have it.

this also closes: #33386

silverwind · 2026-04-15T14:45:29Z

Let's merge #37225 first and then we can use this PR to install a comprehensive renovate config that covers actions,go,npm,python deps.

Also I will then decided on which auth mechanism to use and after merge, a admin will need to install that auth.

Renovate has two config files: global and local. Prior to this change, it read the config as global and local at the same time. This fixes the issue removing the repo scoped config and giving the renovate global only without requirement for in repository one. This also enables migration of the config - which I assume will also work on global configuration. Without this, renovate will compain about the config having warnings during runs and on dashboard.

TheFox0x7 · 2026-04-26T12:06:39Z

Done from my side, unless we want to enable the dashboard. I find it useful as a general overview of what dependencies there are, but unpinned isn't very useful in the first place so... I'd like to see some others voice their opinions on it.

silverwind · 2026-04-26T12:11:44Z

I still think dashboard is mostly useless noise.

bircni · 2026-04-26T12:14:04Z

Let's start with the dashboard and if it bothers us we remove...

enable dashboard

bircni · 2026-04-26T12:38:26Z

@TheFox0x7 can you approve

silverwind · 2026-04-26T12:43:46Z

Let's start with the dashboard and if it bothers us we remove...

Ok with me if we won't pin it, at least initially.

TheFox0x7

I don't get why you're so against the dashboard. It's a single issue which is more informative than looking at the job logs as to why the bot fails, groups items or misbehaves.

Especially since no one is making you looked at the pinned issues anyway and scrolling slightly down already happens if there's a release pending.

silverwind · 2026-04-26T13:37:15Z

I'm not against if it's helpful. I'm just annoyed when seeing a "Dependency dashboard" pinned issue on the issues list, I find it distracting when pinned. But I guess it's a minor issue, Gitea already has "Release" issues pinned regularily so at least it's not extra scroll distance.

I think I generally dislike any pinned issues unless they give substantial value for every reader.

silverwind · 2026-04-26T14:43:21Z

Dashboard is here: #37438

silverwind · 2026-04-26T14:47:53Z

Follow-up on the dashboard warning in #37438:

⚠️ WARN: Post-upgrade task did not match any on allowedCommands list

This comes from the Mend.io hosted Renovate also seeing the repo (note the "Mend.io Web Portal" link in the dashboard body). Its global allowedCommands doesn't include make tidy/make svg, so it warns and skips them. The self-hosted cron-renovate workflow added in this PR is the authoritative instance and runs them fine via RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS.

Suggestion: an admin should uninstall the Mend Renovate GitHub App from go-gitea/gitea (org → Settings → Installations). It's redundant with the self-hosted workflow, silences the warning, removes the duplicate dashboard, and avoids two bots racing on renovate/* branches.

Comment written by Claude Opus 4.7.

silverwind · 2026-04-26T14:48:28Z

@lunny please do the above

TheFox0x7 · 2026-04-26T14:49:28Z

I don't get how this happened... what token was even added?

silverwind · 2026-04-26T14:57:38Z

Certainly odd, but at least I don't see duplicate dashboards:

https://github.com/go-gitea/gitea/issues?q=is%3Aissue%20state%3Aopen%20author%3Aapp%2Frenovate

I think app needs to be removed and then the self-hosted action will run tomorrow and do the onboarding issue as well as open a new dashboard issue.

TheFox0x7 · 2026-04-26T14:59:14Z

this has yet to run, that's the reason why https://github.com/go-gitea/gitea/actions/workflows/cron-renovate.yml

silverwind · 2026-04-26T15:04:30Z

Yeah, app just needs to be removed and the wrong dashboard needs to be closed. then run the action manually once to get the onboarding which should then make the dashboard and start opening PRs for updates.

* origin/main: (176 commits) Refactor pull request view (3) (go-gitea#37439) Update 1.26.1 changelog in main (go-gitea#37442) Make GetPossibleUserByID can handle deleted user (go-gitea#37430) Fix fetch action redirect (go-gitea#37437) Refactor integration test DecodeJSON calls to use generic return value (go-gitea#37432) Integrate renovate bot for all dependency updates (go-gitea#37050) Refactor pull request view (2) (go-gitea#37428) Use MarkLongPolling instead of hard-coded route path (go-gitea#37427) Optimize CI caches (go-gitea#37387) Update AGENTS.md (go-gitea#37420) Update Nix flake (go-gitea#37425) [skip ci] Updated translations via Crowdin remove excessive quote from terraform instructions (go-gitea#37424) Improve testing init, clean up webhook tests (go-gitea#37412) Fix color regressions, add `priority` color (go-gitea#37417) [skip ci] Updated translations via Crowdin Stabilize e2e logout propagation test (go-gitea#37403) refactor: serve site manifest via `/assets/site-manifest.json` endpoint (go-gitea#37405) feat(security): set X-Content-Type-Options: nosniff by default (go-gitea#37354) Refactor pull request view (1) (go-gitea#37380) ... # Conflicts: # templates/repo/diff/box.tmpl

* main: (33 commits) refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (go-gitea#37441) Refactor pull request view (3) (go-gitea#37439) Update 1.26.1 changelog in main (go-gitea#37442) Make GetPossibleUserByID can handle deleted user (go-gitea#37430) Fix fetch action redirect (go-gitea#37437) Refactor integration test DecodeJSON calls to use generic return value (go-gitea#37432) Integrate renovate bot for all dependency updates (go-gitea#37050) Refactor pull request view (2) (go-gitea#37428) Use MarkLongPolling instead of hard-coded route path (go-gitea#37427) Optimize CI caches (go-gitea#37387) Update AGENTS.md (go-gitea#37420) Update Nix flake (go-gitea#37425) [skip ci] Updated translations via Crowdin remove excessive quote from terraform instructions (go-gitea#37424) Improve testing init, clean up webhook tests (go-gitea#37412) Fix color regressions, add `priority` color (go-gitea#37417) [skip ci] Updated translations via Crowdin Stabilize e2e logout propagation test (go-gitea#37403) refactor: serve site manifest via `/assets/site-manifest.json` endpoint (go-gitea#37405) feat(security): set X-Content-Type-Options: nosniff by default (go-gitea#37354) ...

…-review-feedback * origin/main: (144 commits) Add API endpoint to reply to pull request review comments (go-gitea#36683) Add CurrentURL template variable back (go-gitea#37444) refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (go-gitea#37441) Refactor pull request view (3) (go-gitea#37439) Update 1.26.1 changelog in main (go-gitea#37442) Make GetPossibleUserByID can handle deleted user (go-gitea#37430) Fix fetch action redirect (go-gitea#37437) Refactor integration test DecodeJSON calls to use generic return value (go-gitea#37432) Integrate renovate bot for all dependency updates (go-gitea#37050) Refactor pull request view (2) (go-gitea#37428) Use MarkLongPolling instead of hard-coded route path (go-gitea#37427) Optimize CI caches (go-gitea#37387) Update AGENTS.md (go-gitea#37420) Update Nix flake (go-gitea#37425) [skip ci] Updated translations via Crowdin remove excessive quote from terraform instructions (go-gitea#37424) Improve testing init, clean up webhook tests (go-gitea#37412) Fix color regressions, add `priority` color (go-gitea#37417) [skip ci] Updated translations via Crowdin Stabilize e2e logout propagation test (go-gitea#37403) ... # Conflicts: # models/project/column.go # routers/web/repo/issue_page_meta.go

Replace dependabot with renovate for GitHub Actions updates

b1a7510

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Mar 31, 2026

github-actions Bot added the modifies/internal label Mar 31, 2026

Add cron-renovate workflow with GitHub App token auth

a0b98c6

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

This comment was marked as outdated.

Sign in to view

silverwind commented Mar 31, 2026

View reviewed changes

Comment thread .github/workflows/cron-renovate.yml Outdated

silverwind and others added 2 commits March 31, 2026 12:35

Apply suggestion from @silverwind

c72863f

Signed-off-by: silverwind <me@silverwind.io>

Add explicit branchPrefix to renovate config

38d626a

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

silverwind requested a review from Copilot March 31, 2026 10:41

Copilot started reviewing on behalf of silverwind March 31, 2026 10:42 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Comment thread .github/workflows/cron-renovate.yml

silverwind and others added 5 commits March 31, 2026 12:50

Add permissions to cron-renovate workflow

31e1c22

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

Add comment explaining fork guard condition

21af37e

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

Add comment explaining repository scope

66e1b46

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

Rename renovate.json to renovate.json5

be28ab8

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

Add explicit configurationFile to renovate workflow

b35ee42

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

silverwind commented Mar 31, 2026

View reviewed changes

Comment thread renovate.json5 Outdated

bircni reviewed Mar 31, 2026

View reviewed changes

Comment thread renovate.json5 Outdated

TheFox0x7 approved these changes Mar 31, 2026

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Mar 31, 2026

bircni approved these changes Mar 31, 2026

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Mar 31, 2026

wxiaoguang reviewed Apr 1, 2026

View reviewed changes

Comment thread .github/workflows/cron-renovate.yml Outdated

silverwind marked this pull request as draft April 1, 2026 17:07

DaanSelen mentioned this pull request Apr 8, 2026

Update go dependencies #37141

Merged

silverwind commented Apr 26, 2026

View reviewed changes

Comment thread .github/workflows/cron-renovate.yml Outdated

move global configuration to env vars

84efb4d

enable dashboard

Merge branch 'main' into renovate

f4e9afa

TheFox0x7 approved these changes Apr 26, 2026

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Apr 26, 2026

silverwind added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Apr 26, 2026

Merge branch 'main' into renovate

57f250a

silverwind enabled auto-merge (squash) April 26, 2026 14:01

silverwind merged commit 99cd4f6 into go-gitea:main Apr 26, 2026
26 checks passed

silverwind deleted the renovate branch April 26, 2026 14:25

GiteaBot added this to the 1.27.0 milestone Apr 26, 2026

GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Apr 26, 2026

Uh oh!

Conversation

silverwind commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Admin steps before/after merge

1. Create the RENOVATE_TOKEN secret

2. (Recommended) Branch protection for renovate/**

3. Verify

Uh oh!

TheFox0x7 commented Mar 31, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

silverwind commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheFox0x7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

silverwind commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

TheFox0x7 commented Apr 26, 2026

Uh oh!

silverwind commented Apr 26, 2026

Uh oh!

bircni commented Apr 26, 2026

Uh oh!

bircni commented Apr 26, 2026

Uh oh!

silverwind commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheFox0x7 left a comment

Choose a reason for hiding this comment

Uh oh!

silverwind commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

silverwind commented Apr 26, 2026

Uh oh!

silverwind commented Apr 26, 2026

Uh oh!

silverwind commented Apr 26, 2026

Uh oh!

TheFox0x7 commented Apr 26, 2026

Uh oh!

silverwind commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheFox0x7 commented Apr 26, 2026

Uh oh!

silverwind commented Apr 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

silverwind commented Mar 31, 2026 •

edited

Loading

1. Create the `RENOVATE_TOKEN` secret

2. (Recommended) Branch protection for `renovate/**`

silverwind commented Apr 15, 2026 •

edited

Loading

silverwind commented Apr 26, 2026 •

edited

Loading

silverwind commented Apr 26, 2026 •

edited

Loading

silverwind commented Apr 26, 2026 •

edited

Loading